CVE-2026-40321 is a high-severity vulnerability in DNN Platform (formerly DotNetNuke) affecting versions before 10.2.2. The issue arises from improper neutralization of alternate cross-site scripting (XSS) syntax in SVG file uploads, allowing attackers to embed scripts that execute in the context of both authenticated and unauthenticated users. The risk is elevated if the scripts run with power user privileges. The vulnerability has a CVSS 3.1 score of 8.1, indicating network attack vector, high complexity, low privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. The vendor has released version 10.2.2 to address this issue.

Successful exploitation allows execution of malicious scripts via SVG uploads, potentially compromising user sessions, data confidentiality, integrity, and availability within the DNN Platform environment. The impact is more severe if the victim has elevated privileges. No known active exploitation has been reported.

Upgrade affected DNN Platform installations to version 10.2.2 or later, where this vulnerability is patched. Since no official patch links or advisories are provided, verify the upgrade from the vendor's official channels. Patch status is not explicitly confirmed beyond the version update, so check vendor advisories for the latest remediation guidance.